When errors or other notable events are detected in your application events, you might wish to carry out some further investigation or remediation measures. Often, this involves creating a ticket in a system to assign and track progress.
This recipe will show you how you can take error code data from your search results in Splunk and have it open a ticket in your helpdesk system, using a Splunk workflow action. Of course, there are tons of different ticketing systems in use out there, and there isn't a one-size-fits-all approach. So, while the principles of this recipe are sound, you might need to configure things slightly differently to work with the ticketing system in use within your own business.
To step through this recipe, you will need a running Splunk Enterprise server, with the sample data loaded from Chapter 1, Play Time – Getting Data In. You should be familiar with navigating the Splunk user interface.